FaulmorFaulmor
Back home
v2.00.001 - LATEST

Changelog

Faulmor Every build, versioned and dated. Most recent first.

  • v2.00.0012026-08-24

    Cleaner loader links + LootLabs key system fixed & bypass-protected

    • ›Loader links now use a cleaner, dedicated address: `https://api.faulmor.site/v2/<hash>/lua`. The dashboard and Discord bot generate it automatically, and your existing loadstrings keep working.
    • ›Fixed the LootLabs key system. LootLabs moved their API, so link creation was silently failing and no keys were issued; the integration now points at the current endpoints and issues keys again. Just make sure your LootLabs API token is saved in the Monetize tab.
    • ›Added LootLabs bypass protection: paste the postback URL from the Monetize tab into your LootLabs panel and keys are only handed out after LootLabs confirms the ad was actually completed. It is optional and turns on automatically once your first completed ad reports in.
  • v2.00.0002026-08-22

    Faulmor 2.0 — Back online, stronger and more reliable

    • ›**Execution reliability restored.** Fixed an issue that could cause some scripts to load without running. Scripts now execute reliably across supported executors again.
    • ›**Stronger protection.** Standard and Maximum protection has been upgraded and moved onto more reliable infrastructure, so it stays available even under heavy load.
    • ›**Smoother delivery.** A range of behind-the-scenes improvements to how protected scripts are prepared, delivered, and run.
    • ›**Security & stability pass.** A platform-wide round of security and reliability hardening.
    • ›**Back online.** Faulmor is out of maintenance and fully live again — thanks for your patience.
  • v1.80.0012026-08-07

    Part 4: Secret, Logging & Configuration Security

    • ›**Security Hardening Part 4:** Conducted a comprehensive secret, logging, and configuration audit. Hardened internal error responses to prevent information disclosure, moved sensitive server keys to authoritative server-only modules, and standardized redaction across all logging utilities. Verified that no secrets enter client bundles, logs, or public API responses.
    • ›**V5 Stability & Cooldown:** Reduced V5 (Stackfuscate) host cooldown to 500ms and standardized remote timeout handling to mitigate 502/504 errors during peak load.
    • ›**Loader Integrity:** Enforced local VM4 engine as the primary hardening layer for loader delivery, reducing remote dependency while maintaining full polymorphic protection.
    • ›**Watermark Standardization:** Enforced `-- PROTECTED BY STACKFUSCATE V.01` as the uniform watermark for all V5-processed outputs.
  • v1.80.0002026-08-06

    Brand Redesign & Performance Overhaul

    • ›Complete visual redesign of the landing page and core brand assets with a high-contrast obsidian and gold theme.
    • ›Migrated navigation and layout components to a high-performance framer-motion architecture for smoother transitions.
    • ›Unified the design system across the landing page, changelog, and FAQ with consistent typography and interactive dot-grid effects.
    • ›Standardized UI components (buttons, cards, and reveal effects) to use the new Tailwind CSS v4 design tokens.
  • v1.76.0352026-08-07

    Part 3: Server-Side Authorization & Abuse Resistance

    • ›**Chain of Trust Implementation:** Deployed the AuthorizationToken → SessionToken → ExecutionTicket chain, moving the security boundary entirely to the backend. Tokens are now short-lived (1h/2m) and bound to server-verified HWIDs.
    • ›**Atomic HWID Enrollment:** Replaced 'trust-on-first-use' with a hardened enrollment state machine. New keys now require explicit user confirmation through the dashboard, secured by atomic 5-minute confirmation codes and database locks.
    • ›**Multi-Identity Rate Limiting:** Implemented a multi-dimensional rate limiter that correlates IP, Key ID, and server-established HWID to prevent distributed abuse attempts.
    • ›**Replay Resistance:** Enforced mandatory one-time nonce consumption for Stage 2/3 loader delivery, preventing authentication replay during the token lifetime.
    • ›**V5 Caching:** Implemented background caching for Stackfuscate results, reducing host load and execution latency for recurring script versions.
  • v1.76.0342026-08-03

    Critical V5 host and multi-API panel recovery

    • ›Fixed the V5 host killing valid protection jobs under an unsafe memory rule, which caused intermittent 502 errors even while the compile line was working correctly.
    • ›Multi-API servers now keep each script's panel channel, buyer role, and panel design tied to the API selected in /deploypanel.
    • ›Bot invites built from a Guild ID now preselect that server instead of opening an empty server picker.
  • v1.76.0332026-08-02

    Anti-theft heartbeat & download status polish

    • ›Added a runtime heartbeat inside every protected build that verifies it is being executed through the official loader; scripts ripped and reposted under someone else's name now refuse to run and kick the player with a clear error code.
    • ›Fixed Standard-mode downloads incorrectly skipping the top-tier protection and replaced the oversized fallback warning with a clear successful-download status.
    • ›Fixed a timeout mismatch that could cut off protected builds immediately after parsing instead of allowing the full compilation window.
  • v1.76.0322026-08-02

    Critical V5 public delivery recovery

    • ›Fixed Standard scripts compiling V5 during player execution instead of reusing the upload build. Reupload the source once to create the verified V5 build for public execution.
    • ›Fixed large V5 builds timing out early and issuing overlapping retries; queued builds now keep one request alive through the full processing window.
    • ›Fixed tester APIs skipping V5 cache creation when their dashboard was set to Quick mode. Tester uploads now save the successful V5 host output so public execution serves V5 instead of V4.
  • v1.76.0312026-08-02

    Critical Standard build queue

    • ›Standard protection requests now enter one ordered queue, preventing simultaneous builds from overwhelming the remote worker.
    • ›Standard builds are no longer silently replaced by the faster protection mode when the worker is busy. Requests wait their turn and return a clear retry message if the service itself fails.
  • v1.76.0302026-08-01

    Standard obfuscation now truly served on every execution

    • ›Standard scripts now cache the stronger obfuscated build the first time it's produced, so every subsequent player execution serves the stronger tier instead of falling back to the faster one when the remote service is busy or asleep.
    • ›The cache automatically refreshes when you re-upload or restore source, so edits always ship a fresh build.
  • v1.76.0292026-08-01

    Standard obfuscation reaches public exec

    • ›Standard scripts now actually ship the stronger obfuscation on live executions instead of quietly falling back to the faster tier when the remote service hiccuped.
    • ›When the remote service is unreachable, the exec pipeline records the reason and switches to the local fallback so players are never left without a working script.
  • v1.76.0282026-08-01

    Admin controls and V5 connection recovery

    • ›Admin panel now has an IP Bans tab for banning and unbanning addresses globally.
    • ›Improved remote obfuscation request compatibility and error reporting so service-side failures can be diagnosed instead of appearing as a generic unavailable message.
    • ›V5 requests now stop immediately when the external host redirects to itself, replacing the repeated URL wall with a clear proxy configuration error.
  • v1.76.0272026-07-31

    Support assistant, announcements bell, bigger standard uploads

    • ›Support tickets now get an instant first reply from the Faulmor Assistant, the same helper that runs in the Discord server. It answers from the full Faulmor knowledge base and steps aside the moment a human admin replies to your ticket.
    • ›Added a notification bell to the top right of every page. Open it to read site announcements and dismiss any you have already seen.
    • ›Standard (obfuscated) scripts share the same 2.5 MB upload cap as Own Source, up from 1 MB.
  • v1.76.0262026-07-30

    Key gate controls + bot invite fix

    • ›Patched update webhook delivery so scheduled changelog posts reach the Discord update channel again.
    • ›Fixed the Discord bot invite link, it works for every server again.
    • ›Monetize tab has a new Mini key system card: switch the code step on or off per script and set how long the code stays on screen (0 to 120s).
  • v1.76.0252026-07-28

    One-Shot Loader for everyone + big bot lockdown pass

    • ›One-Shot Loader is live for Citizen and Royal. Scripts start faster because the whole handshake is fused into a single signed round-trip instead of the old multi-step dance.
    • ›Ad-gate now hands out a one-time redeem code instead of a live script key. Users have to redeem it in your Discord panel, so the owner alert always fires and alternative access sites can't skip past you anymore.
    • ›New anti-RE verification gate for the official Discord. Flagged accounts silently get a 'please wait' page and are removed in the background, legit users get their role in seconds like normal.
    • ›Locked down the bot admin gate. Only the exact Admin Role you configured can run whitelist / blacklist / genkey / deploypanel now. Discord's built-in Administrator perm and server-owner alternative accesses are gone.
    • ›API keys no longer appear in pickers, embeds or audit logs. You'll see the script title only, and every linked key is now guild-locked so a leaked key can't be redeemed in another server.
    • ›Fixed /lookup reporting 'not whitelisted' for users who clearly were, and stopped /whitelist from occasionally landing on the wrong linked script in servers with multiple APIs.
    • ›Panel command replies (/whitelist, /blacklist, /deploypanel and friends) are ephemeral now, so channels stay clean and there's nothing to delete after each action.
  • v1.76.0232026-07-28

    Faster repeat loads, silent no-op outside Roblox, panel deploy fixes

    • ›**VM4 compile cache.** Parsing and compiling a script into VM4 bytecode is now cached in-memory per edge isolate (LRU, ~10 min TTL) and re-emitted with a fresh polymorphic seed on every request. Cold-load latency is unchanged, but repeat deliveries of the same script skip the heavy compile step — big scripts that took 15-20s to serve now warm to a few seconds after the first hit. Same security posture: each delivery is still a unique polymorphic emit, no plaintext leaves the cache.
    • ›**Loader silently no-ops outside Roblox.** Stage 1 stub runs a pcall-wrapped positive-signal probe (game/workspace userdata, typeof, Instance.new, Enum) before touching Stage 2. If it can prove the runtime is curl, browser Fengari, Node, headless Luau, or a dumper backend, it silently returns without revealing anything. Real executors trip at least one signal, so no false positives.
    • ›**/deploypanel posting the wrong panel after switching APIs.** When a server had multiple linked APIs and switched between them, /deploypanel could post the previous script's cosmetics. Panel cosmetics are now sourced from other guilds already running that API, and each guild's saved cosmetics refresh when its active API changes. Applies to /deploypanel and the Dashboard's manual deploy.
    • ›**Panel image URLs validated on save.** Dashboard > Panel now HEAD-checks image and thumbnail URLs, rejects expiring Discord CDN attachment links, and returns a clear error when saving before /linkapi instead of silently updating zero rows.
  • v1.76.0222026-07-24

    Per-guild IP bans + Faulmor 1-A panel sync fixes + tester loader speedup

    • ›**Per-guild blocked IPs.** IP bans triggered by leak-flags and anti-tamper are now scoped to the specific script (and by extension its guild) instead of applying to every Faulmor tenant. An IP flagged on one script never affects executions of a different script or a different Discord server. Older admin-set global entries stay in force so existing abuse blocks are not lost.
    • ›**Faulmor 1-A whitelist isolation.** Fixed a panel sync bug where whitelisting a user under one linked API let them fetch keys for other scripts on the same Discord server. The panel now only issues a script key when the user is whitelisted under the exact API that panel serves; legacy pre-per-API rows are still honored.
    • ›**/unwhitelist across linked APIs.** /unwhitelist no longer falsely reports 'not whitelisted' when the user was whitelisted under a linked API other than the guild's currently-active one. It now searches every linked API for the guild and removes matching rows plus their script_keys.
    • ›**Tester loader: combined delivery hop.** Tester scripts now receive the loader payload inline in the first delivery response, skipping one round-trip. Same HWID binding, same one-shot nonce, same encryption — median execution latency drops ~300-800ms on tester keys. Non-tester scripts are unchanged.
    • ›**Obfuscator cleanup.** Removed two dormant obfuscation pipelines that were kept around from earlier experiments but never served production traffic. Active build path and compatibility fallback are unchanged.
  • v1.76.0212026-07-23

    Loader ~4x faster + panel Get Script speedup + Maximum-mode soak fixes

    • ›**Execution latency cut from ~20s to ~5s on mobile executors.** Exec responses now use header-only integrity (V3) instead of the per-byte encrypted keystream (V4). Executors without native crypto no longer stall running SHA256 in pure Lua over the whole payload. Transport is still HTTPS and the response is still HMAC-authenticated with a per-user secret.
    • ›Trusted Roblox executor user-agents skip the anti-dump micro-stub round trip and get the real bootstrap directly. Scrapers and unknown clients still hit the stub, so passive HttpGet dumping is still blocked.
    • ›Panel **Get Script** button: whitelist, primary, and legacy fallback lookups now run in parallel, cutting one database round-trip off every click.
    • ›Maximum mode (admin-only soak): chunk bootstrap now uses the executor HTTP cascade (request / syn.request / http.request / fluxus.request) with HttpService as a last resort, so Volt, Delta, Synapse Z, Madium, Yub X, and Bunni load Maximum scripts. Chunk sessions extended from 2 to 10 minutes. VM-build failures now ship the source-VM fallback directly instead of routing through chunk delivery.
  • v1.76.0202026-07-23

    Citizen plan: 10 script dashboards limit

    • ›Citizen (free) plan is now capped at **10 script dashboards** per account. Trying to create an 11th returns a clear message asking you to delete an existing script to free a slot.
    • ›Royal and Lifetime plans remain **unlimited** — no cap on how many dashboards you can create.
    • ›Existing scripts above the cap are not deleted; the limit only blocks new creation until you're back under 10 or upgrade.
  • v1.76.0192026-07-23

    Ad-gate verification code, Lifetime plan, Faulmor Claude priority

    • ›**Ad-gate hardened against alternative access sites.** After completing the ad, users now land on an intermediate Faulmor page that shows a unique 12-character verification code and auto-redirects after 5 seconds. Back on `/getkey/<hash>` they must type the code before a key is issued. The code is bound to a per-browser cookie set on that intermediate page, so scraper alternative access sites that resolve our destination URL server-side don't share the cookie and get rejected at redemption. Real users still complete the flow in one click.
    • ›**Lifetime tier on /pricing:** one-time $15 payment via Plisio (crypto) grants everything in Royal permanently. No monthly billing, no expiry, no auto-renew. Full unlimited obfuscations, unlimited Maximum-mode, Server-Verified Runtime, priority queue, and early access to new VM layers, forever.
    • ›**Faulmor Claude priority fix:** Faulmor now treats Claude as primary whenever `ANTHROPIC_AUTH_TOKEN` is present, even if an old `FAULMOR_AI_PROVIDER=groq` value is still saved on the bot host. Groq stays as fallback, and `FAULMOR_AI_PROVIDER=groq-only` is the new explicit force-Groq switch.
  • v1.76.0171970-01-01

    HWID lock false-mismatch fix

    • ›Short-lived ad-gate keys no longer trip the HWID mismatch honeypot. Temporary keys were being locked to the first HWID seen and then flagging the same machine as a mismatch when the executor rotated its fingerprint mid-session, producing a flood of false alerts in the anti-crack feed and killing legitimate executions. Temporary and free keys now skip HWID enforcement; lifetime, paid, and stockpile keys keep the strict lock.
    • ›HWID lock is now case-insensitive and refuses to bind an empty or unknown fingerprint, so a one-off missing HWID at first activation no longer poisons every later execution.
  • v1.76.0161970-01-01

    Faulmor 1-A invite fix + ad-gate desktop alternative access + whitelist key sync

    • ›Fixed the Faulmor 1-A invite link: it was requesting only the Manage Roles permission, so once the bot joined it could not send messages, embed the panel, react, or read history, and `/deploypanel` silently no-op'd. Invite now requests the full permission set the bot actually uses (View Channels, Send Messages, Embed Links, Attach Files, Read History, Add Reactions, External Emojis, Manage Messages, Manage Roles). Re-invite the bot to apply.
    • ›Closed a desktop alternative access on `/getkey/<hash>`: the ad-gate no longer returns the redemption token in the start response, so users cannot pull it from browser devtools and skip the ad. The token now reaches the browser only via the ad provider's server-side redirect after a real completion. Mobile behavior is unchanged.
    • ›`/whitelist add` was writing the DM'd key into the bot's whitelist table but inserting the paired execution record with a different auto-generated key, so a newly whitelisted user hit `Invalid Key!` on their very first run. The whitelist path now stores the same key on both sides, and every currently active whitelist entry has been backfilled so users who were previously stuck can execute immediately without being re-whitelisted.
  • v1.76.0151970-01-01

    Faulmor 1-A bot auth + ad-gate hardening

    • ›Faulmor 1-A bot-host requests are now accepted by the command data endpoints, fixing false `unauthorized` replies after a server is linked and the user has the configured role.
    • ›Discord bot invite buttons now always point to the Faulmor 1-A application instead of falling back to the original Faulmor bot.
    • ›Ad-gate redirects are now bound to an owner-scoped encrypted payload, so common alternative access sites can no longer skip the ad step and mint free keys against your script.
  • v1.76.0141970-01-01

    Ad-gate polish + dashboard Overview refresh

    • ›Ad-gate now enforces one active free key per IP per script. Repeat visits from the same IP land back on the completed page with the existing key until it expires — stops key stockpiling and reselling without any owner-side config.
    • ›You can now attach a custom logo image to each script from the **Overview** tab. It appears in the dashboard header next to the title and will surface in the Discord panel embed where linked. Tap the logo tile to change or set it directly, no separate button.
    • ›Overview analytics now includes an **Ads completed** row: today, 7d, 30d, and all-time counts of users who finished your ad-gate.
    • ›Sticky header logo hides on the Overview tab so the big identity card is the single source of truth, and the layout stacks cleanly on mobile.
    • ›Create Script dialog has a new optional **Description** field below the name for a quick summary of what the script does.
  • v1.76.0132026-07-19

    Ad-gate one-key-per-(IP+HWID)

    • ›Free-key reuse now pins to both the visitor IP and a browser fingerprint. Switching device on the same network yields a fresh key instead of getting silently redirected to the old one.
    • ›Same IP + same browser still short-circuits back to the completion URL with the existing key until it expires, so nothing changes for legit repeat visitors trying to grab their key again.
    • ›Complete step now rejects a mismatched fingerprint even when the IP matches, blocking cross-device nonce sharing.
  • v1.76.0122026-07-19

    Critical ad-gate key fixes

    • ›Lootlabs Test link now returns the real provider error, including invalid token, incomplete profile, or missing field messages, instead of a generic Unauthorized notice.
    • ›Discord redeem now accepts ad-gate keys with uppercase letters or symbols, including users still running older bot hosts that changed key casing before sending it to the backend.
    • ›The `/getkey` result snippet now assigns the issued key to `script_key` before running the loader, and execution validation now accepts the full ad-key alphabet including `#` and `%`, so paid ad-gate users no longer hit `Invalid Key` after copying the code directly from the key page.
  • v1.76.0112026-07-19

    Ad-gate works on paid scripts without the sub-toggle

    • ›Fixed the public `/getkey/<hash>` page returning `The owner hasn't enabled ad-gate for this script` on paid scripts when the main Monetize switch was on. The public ad flow now honours the main `Enabled` toggle regardless of the paid-script Free Key button sub-toggle.
    • ›The `Free Key button (paid script)` sub-toggle now only controls whether the Discord redeem panel shows a Free Key button. It no longer gates the public getkey link.
    • ›Paid scripts fall back to the general key lifetime when a paid-specific duration is not set, so a first-time save no longer hands out 24h keys unexpectedly.
  • v1.76.0102026-07-19

    Monetize tab on paid scripts + Get Key button for FFA

    • ›The **Monetize** tab now appears on every script dashboard, not just FFA. Paid script owners can enable the ad-gate free-key flow when they want to offer a free path alongside their paid keys.
    • ›Fixed `/getkey/<hash>` for paid scripts: with `Free key via ad` enabled it now loads correctly instead of returning `Script not found or disabled`, and uses the paid-specific key duration setting.
    • ›Discord panel now shows a **Get Key** button on FFA scripts when the ad-gate is enabled, routing users straight to the ad flow. Paid scripts keep the existing **Free Key** button when the paid free-key toggle is on.
    • ›Auto-redeploys refresh the panel button label whenever the monetize state changes.
  • v1.76.0092026-07-19

    Dashboard polish and Monetize auth fix

    • ›Rewrote descriptive text across landing, features, FAQ, changelog, login, codes, privacy, and terms in a tighter, technical voice with plain punctuation.
    • ›Tester API preview: advanced Discord bot customization can set bot profile picture and description per guild, ready for wider release after the Faulmor revamp.
    • ›Fixed the Monetize tab server calls so Save and Test link use Faulmor's Discord or manual login session instead of the old backend bearer session, removing the `Unauthorized: No authorization header provided` error for signed-in dashboard users.
  • v1.76.0082026-07-19

    Lootlabs ad-gate fix

    • ›Fixed Lootlabs integration on the Monetize tab: Test link and live ad-gate now hit the correct Lootlabs endpoint with proper Bearer auth and required fields. Owners who saw an `Unauthorized: No authorization header provided` error should re-save their Lootlabs key and hit Test link again.
    • ›No changes needed on the bot or loader side.
  • v1.76.0072026-07-19

    Monetization live for FFA and paid scripts

    • ›**Monetize tab** is now available on every script (FFA and paid) for both Citizen and Royal. Paste your Lootlabs, Work.ink, or Linkvertise API key and enable the ad-gate.
    • ›**Free Key button on paid scripts**: paid script owners can add a Free Key button to the Discord whitelist panel. Users complete one ad from your account and receive a temporary key. Configure key lifetime and per-user cooldown from the Monetize tab.
    • ›You keep 100% of ad revenue. Faulmor never sees or touches your provider account.
    • ›When the ad-gate is disabled the Free Key button disappears automatically on the next panel deploy.
  • v1.76.0062026-07-18

    Ad-link monetization, promo codes, Faulmor 1-A OAuth switch

    • ›New **Monetize** tab on every free (FFA) script dashboard: paste your own Lootlabs, Work.ink, or Linkvertise API key and enable an ad-gate. Users visit `faulmor.site/getkey/<hash>`, complete one ad from your account, and receive a temporary key (1 to 168h, owner-configurable). You keep 100% of the ad revenue, Faulmor never sees your provider account. Enabling the gate automatically disables the public loadstring for that script; disabling restores it.
    • ›New **/codes** page and admin **Codes** tab: admins mint promo codes for royal discounts, obfuscation credits, or short royal trials. Users redeem at faulmor.site/codes and the reward applies automatically at checkout or in the dashboard.
    • ›Admin panel now has an **OAuth App** tab to switch live Discord sign-in between the original app and Faulmor 1-A without a redeploy. Handy for rotating out a rate-limited or compromised Discord app.
    • ›Faster session validation for tester scripts: repeated background checks now ride on a signed short-lived session instead of a full re-validation, cutting live-session latency. Owner kill actions (key revoke, blacklist, disable) still propagate within a couple seconds and the path is fail-closed on any tamper.
    • ›Roblox username now appears on the Discord execution webhook alongside the Discord user for both whitelisted and public FFA executions, so owners can trace an exec even when the free key is not user-bound.
    • ›Royal plan price is now **$5/month** (was $3).
  • v1.76.0052026-07-12

    Tester loader reliability + owner-controlled HWID blacklist

    • ›Added a new **Blacklist** tab on every script dashboard: auto-detected HWIDs now land as *pending* and require owner approval before they are silently honeypotted. Owners can approve, reject, unblacklist, or whitelist a HWID (whitelist exempts it from future auto-blacklist).
    • ›HWID blacklists remain strictly per-script - a ban on one script never carries over to another.
    • ›Tester scripts (via tester API keys) no longer trigger auto-blacklist or HWID-mismatch honeypot, so owners can move between phone and laptop while iterating.
    • ›Patched the tester loader handoff so the real executor environment is preserved through the micro-stub and VM diagnostic wrapper, preventing silent no-output runs on stricter executors.
    • ›Added a new one-shot loader delivery mode (opt-in, FFA scripts): the whole protected script arrives in a single response instead of the multi-step handshake, removing an entire class of silent-execution bugs caused by header-keyed transport encryption.
  • v1.76.0042026-07-11

    Critical loader execution recovery

    • ›Fixed a Stage-1 delivery wrapper path that could stop before Stage 2 with no console output on some Roblox executors, making a valid loadstring appear to do absolutely nothing.
    • ›First loader response remains a tiny bootstrap so passive dumpers capture only a small handoff instead of the full protected loader shell.
    • ›`/massunwhitelist` and `/massunblacklist` now require a **role** and only affect users with that role, instead of wiping the entire server list.
  • v1.76.0032026-07-11

    Header navigation visibility + VM runtime hardening

    • ›Reduced VM runtime fingerprinting and strengthened internal constant-pool integrity.
    • ›Increased desktop dashboard navigation contrast and header presence so the top navigation remains visible on live screens.
    • ›Replaced the old desktop top-button layout with the burger drawer on every viewport, keeping the Faulmor brand centered across live desktop and preview screens.
  • v1.76.0022026-07-10

    Loader v2 rolled out to everyone + Faulmor admin parity

    • ›Loader v2 (hardened key-exchange delivery path) is now the default for every script and every client - no more tester-only gating. Passive network dumpers walk away with strictly less usable material than on the legacy path, and the legacy path stays wired in as an instant kill-switch fallback.
    • ›Faulmor bot now mirrors the Faulmor Admin Panel with Fame-only slash commands: kill switch, broadcast banner, maintenance mode, changelog publisher, analytics, anti-crack feed, audit log, and an on-demand obfuscator that returns a hardened .lua file. Every admin command is signed with the shared bot secret and logged to the admin audit trail with the acting Discord ID.
    • ›Faulmor bot slash commands now register from the bot host on startup (manual register uses the same host-owned guild sync path), and the packaged upload is a flat zip that leaves environment files on the host between re-uploads.
  • v1.76.0012026-07-08

    Per-command API picker + delivery hardening

    • ›Discord bot: every action command (`/whitelist`, `/unwhitelist`, `/massunwhitelist`, `/genkey`, `/massgenkeys`, `/blacklist`, `/unblacklist`, `/massunblacklist`, `/deploypanel`) now has an **api** autocomplete option, so servers with multiple linked APIs can pick which key each command runs against - no more silently using whichever key was last active.
    • ›Retired `/setactiveapi`: choosing the api on any command now switches the active key automatically, and if a server has more than one API linked the bot refuses to guess and asks the admin to pick.
    • ›Tightened loader delivery so passive network dumpers that only capture the first-stage response no longer walk away with usable key material.
    • ›Stabilized production builds for the newest protection pipeline so tester script builds stay deployable.
  • v1.76.0002026-07-07

    Next-gen protection is now the default

    • ›All script builds now go through our newest protection pipeline by default - stronger runtime hardening, cleaner delivery, and better reliability across supported executors.
    • ›Retired the older protection tiers from every user-facing surface (dashboard, admin playground, tester APIs). No more version pickers - you always get the strongest build we ship.
    • ›If a script can't be built with the new pipeline (unsupported syntax, parser errors), it automatically falls back to a plain-parser build and the dashboard now shows a red warning next to the download button.
    • ›When a fallback build ships, the script owner is pinged on their configured alert webhook with the failing fingerprint so they can rewrite the offending Lua for full protection.
  • v1.75.0032026-07-05

    New VM tester path + build stability

    • ›The script dashboard's Discord setup now keeps server configuration in the panel and gates bot invite flow until the required fields are saved.
    • ›Tester API scripts now enter the New-VM build path directly, with fallback still disabled so VM v3 validation failures stay visible instead of silently downgrading.
    • ›Development builds now recognize the New-VM compiler's WebAssembly module import, fixing the build break that blocked VM v3 testing.
  • v1.75.0002026-07-04

    New /setup command, safer runtime routing, VM stability patch

    • ›Added `/setup` - one Discord command that picks the admin role for your server and links your Faulmor API key in a single step. Every other command now refuses to run until `/setup` has been completed, and `/menu` plus every admin command respect the chosen role.
    • ›Removed `/linkapi` (folded into `/setup`) and `/listapis` (`/setactiveapi` already lists every linked API in its picker). Old command names return a friendly redirect.
    • ›Temporarily routed live script execution through Faulmor Safe Mode while the full VM compiler is rebuilt against the regression corpus, so valid scripts stop receiving brittle legacy VM output.
    • ›Stabilized protected runtime execution across stricter Roblox executor environments and cut repeat VM abort paths plus repeated VM callback allocation overhead for large scripts.
  • v1.74.0352026-07-02

    Critical obfuscator reliability patch

    • ›Fixed several full-VM output paths that could corrupt valid Roblox script literals or reject supported Luau before delivery.
    • ›Tightened runtime self-checks so integrity guards catch real key tampering without adding loader startup lag.
    • ›Expanded parser safety coverage for long function signatures and levelled Luau long strings/comments, reducing repeat update regressions.
  • v1.74.0342026-07-02

    Loader latency fix - no more multi-second freeze on execute

    • ›Fixed a runtime path that could freeze the game thread for several seconds on large scripts before user code started running. Execution now begins essentially immediately after the loader hands off, matching the pre-regression feel.
    • ›Rebalanced the protected runtime's internal integrity sampling so the same tamper-detection guarantees hold with a fraction of the per-instruction cost.
    • ›Resolved a rare bytecode path that could abort a valid script mid-execution on its very first tick.
  • v1.74.0322026-07-02

    Critical loader runtime reliability patch

    • ›Fixed a full-VM runtime path that could freeze or stop execution on normal client machines, while keeping the protected delivery flow intact.
    • ›Reduced protected loader payload weight and startup decode work so large scripts spend less time rebuilding the runtime before user code starts.
    • ›Included the recent Roblox method-chain parser and output-scanner fixes in this critical rollout so Citizen and Royal users receive the patch immediately.
  • v1.74.0312026-07-02

    Broader Luau acceptance + safer compound rewrites

    • ›The obfuscator now handles more real-world Luau syntax without failing: `const` declarations, floor-division compound assignment (`//=`), and bitwise operators.
    • ›Fixed floor-division precedence so mixed multiplicative expressions like `a * b // c` are parsed correctly.
    • ›Compound assignments (`+=`, `-=`, `*=`, `/=`, `%=`, `^=`, `..=`) are correctly lowered to standard VM ops.
  • v1.74.0302026-07-02

    Loader reliability + safer Luau builds

    • ›Removed a rare delivery path that could make a valid paid execution return without visible console output, while keeping protected delivery and telemetry intact.
    • ›The obfuscator now accepts broader Luau syntax forms and rewrites them transparently to plain Lua before VM compilation, so supported Roblox scripts need fewer manual edits.
    • ›Added a parser-safety scan for the obfuscator pipeline so malformed Luau rewrites are caught before protected payloads reach script delivery.
  • v1.74.0292026-07-01

    Server-Verified Runtime + Obfuscation Modes + Citizen/Royal plans

    • ›New **Server-Verified Runtime**: eligible scripts are split into multiple encrypted slices fetched sequentially at runtime, each re-keyed per request so no two fetches look alike. A live heartbeat lets us revoke running sessions instantly from the dashboard via the new Live Session Kill-Switch card.
    • ›Consolidated protection settings into a single **Obfuscation Mode** selector with three presets: Quick (fast), Standard (full VM), and Maximum (full VM + Server-Verified Runtime). The old Fast Mode / SVR toggles are gone.
    • ›Introduced plans: **Citizen** (free - 20 obfuscations/week, 3 Maximum-mode uses/month) and **Royal** ($3/mo crypto, coming soon - unlimited everything). Dashboard shows live usage counters and auto-snaps Citizens off Maximum mode when the monthly cap is hit.
    • ›Raised the VM pipeline source cap to 1 MB (was 64 KB), so much larger scripts now build through the full Faulmor VM instead of being rejected.
  • v1.74.0282026-07-01

    Full VM only + broader Luau syntax support

    • ›Removed the compatibility fallback path. Every delivered and downloaded script now goes through the full Faulmor bytecode VM (custom opcodes, K-pool, dispatch loop, vmify envelope) - no more silent base64/loadstring surface.
    • ›If a script uses Luau syntax the parser cannot yet compile, delivery now hard-fails with the exact reason instead of quietly shipping a weaker build, so you always know when to simplify.
    • ›Expanded Luau tolerance: `declare` ambient statements and `declare class ... end` blocks are stripped, and the `!` non-nil assertion (e.g. `foo!.bar`, `f()!`) is now accepted alongside the existing rewrites for `continue`, compound assignments, type annotations, generics, backtick interpolation, `<const>`/`<close>`, `@attributes`, numeric separators, and binary literals.
  • v1.74.0272026-06-30

    Discord login fixes + VM fallback hardening

    • ›Discord sign-in now always uses Faulmor's stable app-owned callback URL instead of request/preview hosts or the retired external callback, preventing Discord's invalid redirect URL error.
    • ›Removed the retired external OAuth client from the login, session, and server-call attachment paths so new Discord sign-ins use only the app-owned callback flow and stop re-triggering the old mobile loop.
    • ›Parser-incompatible scripts no longer fall back to a plain base64 runner; Faulmor now emits a compatibility bytecode VM wrapper so loader-delivered code still uses a VM path even when the full compiler cannot parse the source.
  • v1.74.0262026-06-30

    Login build stability + loader alert fixes

    • ›Per-script Discord execution alerts now also fire for early loader/session blocks tied to a script, and failed Discord webhook responses are surfaced in server logs instead of disappearing silently.
    • ›Loader validation now accepts the new lowercase 36-character dormant/active keys that include `$`, `&`, `@`, and `!`, so redeemed keys work after activation instead of being rejected before lookup.
    • ›Production builds no longer pull request-only login helpers into the browser bundle, keeping the custom Discord/manual login flow deployable.
  • v1.74.0252026-06-29

    Dormant keys + cleaner key management

    • ›`/genkey` and `/massgenkeys` no longer pre-create separate whitelist keys. Generated keys are now **Dormant** placeholders - they only become live, loader-usable keys once a user redeems them through the panel.
    • ›Script dashboard now filters keys by **Active** vs **Dormant**, with sub-filters for **Lifetime** and **Temporary** under Active so big key lists are easier to scan.
    • ›Removed the redundant *Copy key* button from the key card - the *Copy script* button already embeds the key in the loader snippet.
  • v1.74.0112026-06-28

    Bot-owned command cleanup + cleaner public copy

    • ›Removed the remaining legacy website action bridges for Discord/admin/slot operations. Bot-facing data endpoints now update the database directly, keeping Discord command handling fully owned by the hosted bot.
    • ›Homepage hero subtitle, footer text, and meta descriptions now frame Faulmor as a developer protection and licensing tool for Lua code, with clearer language for Discord link previews and search results.
    • ›Hardened the bot-owned Discord command registration path so renamed commands are wiped and re-published from the bot host using the local command list and the configured Discord application ID.
  • v1.74.0102026-06-28

    Multi-API Discord links + manual panel deploy from the dashboard

    • ›Discord servers can now link **multiple** Faulmor APIs at once. Run `/linkapi <api_key>` as many times as you want; one is the **active** API that drives every command. Use `/listapis` to see them all, `/setactiveapi` to switch which one is in use, and the new `/unlink` command opens an ephemeral menu so you pick exactly which linked API to remove - no more accidentally unlinking the wrong script.
    • ›Added a **Manual Deploy** card on each script's Panel tab. Paste a Discord channel ID (and optional buyer role ID) and click *Deploy now* - the bot picks the job up within seconds and posts the configured panel embed straight into that channel. Useful for re-posting after edits without leaving the dashboard.
    • ›Mobile dashboard polish, per-script Alert Webhook, and per-function `LPH_NO_VIRTUALIZE` / `LPH_SKIP` macros (rolled in from 1.74.009).
  • v1.74.0072026-06-26

    Loader reliability hotfix + cleaner bot key commands

    • ›Fixed the loader path that could make a valid script appear to execute while nothing happened. Paid scripts using `script_key="..."` now stay on the stable delivery path, and compatibility checks no longer silently block legitimate executors.
    • ›Repaired affected database rows from the false-positive loader incident and added self-healing for Public/FFA scripts so missing or disabled public keys are recreated automatically.
    • ›The bot-owned `/genkey` and `/massgenkeys` commands now only ask for the details that matter: label for one key, and amount plus optional label for batches. Stockpile/day-style prompts were removed from the Discord command menu.
  • v1.74.0062026-06-26

    Tougher delivery, cleaner dashboard, fresh landing page

    • ›Loader delivery got a quieter, meaner backend: suspicious key patterns are auto-throttled, each delivery is salted uniquely so two captures never look alike, and a small fraction of requests get tripwire responses that flag and blacklist any caller who tries to replay them. Redeem attempts are also rate-limited per account to shut down credential-stuffing.
    • ›Dashboard now shows per-script analytics - a 30-day execution chart and top users - and the script creation flow has a clean Public / Private mode picker plus an HWID Tracking toggle. Public scripts no longer surface key management since they don't use keys. FAQ moved to its own `/faq` page, and Privacy + Terms pages are now live.
    • ›Refreshed the landing page with a new hero image, tighter bento-style feature grid, and updated copy. Discord bot help is consolidated into a single `/menu` command with a category picker, and the bot zip now extracts with files at the root (no more `bot/` wrapper) so Pterodactyl-style hosts read it correctly.
  • v1.74.0052026-06-25

    Smaller payloads, hardware-bound delivery, stronger per-script keying

    • ›Protected payloads now ship through an extra compression stage before encoding, producing noticeably smaller files for the same protection level (typical 25-45% smaller than the previous build).
    • ›Scripts written for other obfuscators that use per-function escape macros (e.g. `LPH_NO_VIRTUALIZE(function() ... end)`) now compile under FaulMor without edits - the macros are accepted and applied at the file level.
    • ›Loader delivery now locks each script key to the first machine that runs it. Attempts to deliver the protected payload on a different machine fail closed without revealing anything to the requester. `/forceresethwid` clears the lock so the legitimate user can re-bind on a new device.
    • ›Each delivery is freshly keyed end-to-end, so two runs on the same machine produce byte-different protected payloads - replaying or diffing captured deliveries no longer yields anything useful.
    • ›Script owners can optionally supply their own 256-bit key that participates in the protected runtime's per-function masking, so even identical source produces divergent protected output across owners.
  • v1.74.0042026-06-25

    Bot host owns the whole Discord surface

    • ›Constants referenced by tag-routed operations now sit behind a separate protection path, so reversing one constant stream no longer exposes every value used by the protected runtime.
    • ›The interpreter now re-checks protected instructions as they execute, catching mid-run tampering much sooner without changing how legitimate scripts run.
    • ›Removed the old website-side Discord command sync/admin UI and retired the remaining website Discord handlers. The gateway bot now owns slash commands, menu buttons, panel buttons/modals, and slot status message refreshes; the site only exposes thin database endpoints.
  • v1.74.0022026-06-23

    Slimmer Level 5 envelope + harder-to-pattern-match VM

    • ›Shrunk the outer envelope on Level 5 builds by roughly half. Same protection, less to download and parse.
    • ›Common `return localVar`, `return "text"`, `return 42`, and `return globalName` tails now compile into a single fused operation instead of two. Removes one of the most recognizable bigram patterns devirtualizers key on.
    • ›Split the main interpreter loop so the simpler operations no longer sit in the same flat chain as the rest. Static signature matchers built from one export of the runtime no longer line up against the next one.
  • v1.74.0012026-06-23

    Bot host now owns every slash command

    • ›Moved the last legacy commands (`/linkapi`, `/unlinkapi`, `/setchannelforlogs`, `/panelhelp`, `/deploypanel`, `/blacklist`, `/unblacklist`, `/massunblacklist`) onto the bot host. The bot posts the redeem panel embed and applies the buyer-role color itself. The website is no longer in the request path for any slash command - it only stores data.
    • ›`/genkey` and `/massgenkeys` now default to Stockpile mode - just pick the command and pass `days`, no need to set `key_type` every time. Stockpile is the right pick for keys handed out ahead of time since the timer only starts when the buyer actually redeems. Timed and Permanent are still available explicitly.
    • ›Renamed `/menu` to `/slotmenu` so it's obvious which command surfaces the slot-management list. The old name still routes to the new one for now, so existing muscle memory keeps working.
  • v1.74.0002026-06-23

    All hosted Discord commands now run on the bot itself

    • ›Moved the whitelist commands (`/whitelist`, `/unwhitelist`, `/massunwhitelist`, `/genkey`, `/massgenkeys`) entirely off the website. The bot builds the embeds, hands out the buyer role, and uploads the keys `.txt` file itself; the website is only touched for the database write. Result: faster replies and bot-host outages no longer take down those commands.
    • ›Moved the slot system commands (`/link`, `/setcount`, `/compensate`, `/transfer`, `/clear`, `/freeze`, `/resume`, `/menu`, `/status`) onto the bot host too. The bot posts the live status embed and deletes the old one itself instead of asking the website to do it.
    • ›Moved the admin commands (`/stats`, `/lookup`, `/forceresethwid`, `/suschannel`) over as well. The bot writes the HWID force-reset log message into your configured log channel directly. Combined with the previous two batches, every hosted slash command now runs on the gateway bot - the website is purely a data backend.
  • v1.73.0002026-06-23

    Bot stability + smaller protected payloads

    • ›Reworked the internal bytecode layout so protected scripts ship with a flatter, more compact instruction representation. Same protection, slightly smaller files - most noticeable on large scripts.
    • ›Removed the old `/massgenkey` command (capped at 50 keys, returned them as an embed) and renamed `/massgen` to `/massgenkeys`. The new command supports up to 1000 keys per run and always delivers them as a `.txt` file attachment.
    • ›The Discord bot now owns its slash command list directly. It no longer fetches commands from the dashboard on startup, so command updates land instantly without a website round-trip and there's one less moving part to drift out of sync.
  • v1.72.0082026-06-23

    Tier 2 hardening - numeric constant + environment guards

    • ›Numeric constants inside protected scripts now go through an additional type-specific encryption layer separate from the string-constant pipeline. Decoding tools that only learned the generic constant decoder will return garbage for every number until they recognize and implement the second layer.
    • ›Added a runtime environment-tampering guard: if a tool swaps the script's execution environment mid-run (a common probe used by dumpers and tracers), the protected script silently locks up instead of continuing.
    • ›Investigated a 30% payload-size reduction by switching the outer wrap's encrypted blob to a string literal. Shelved for now - the format conflicts with our final minification pass and would have shipped a broken Level-5 build. Will revisit once the pipeline is reordered.
  • v1.72.0072026-06-23

    Multi-line obfuscator output + hardening + size fix

    • ›Protected scripts now emit on multiple lines instead of one mega-line, so you can actually skim the output to confirm Faulmor protected your script without scrolling sideways forever. Output is split only at safe statement boundaries - strings, tables, and long brackets stay intact, so runtime behavior is byte-for-byte identical to the old single-line format.
    • ›Added several new protection layers that resist common script-inspection and dumping tools. These changes are invisible at runtime for legitimate scripts but make protected output significantly more annoying to reverse-engineer.
    • ›Fixed a bloat bug in Level-5 (vmify) obfuscation where a tiny script could balloon to ~870 KB. Same input now produces ~200 KB output (~4x smaller) with identical protection.
  • v1.72.0062026-06-22

    Auto-expiring keys + community stats

    • ›Hosted Discord bot command sync now repeats the wipe/delete pass for global and server commands and filters removed names defensively before publishing, so renamed or deleted commands disappear from every server within seconds.
    • ›Added a live 'by the numbers' section to the home page showing how many creators have joined and how many scripts are currently protected, with a call to grow the community.
    • ›Expired, blacklisted, and whitelist-expired keys are now automatically retired every 5 minutes. They're removed from your active User Keys list, but the Roblox user who used the key stays visible on the script dashboard with an EXPIRED or BLACKLISTED badge so history is preserved.
  • v1.72.0052026-06-22

    Instant Discord command cleanup

    • ›Discord bot now pushes command updates to every server it's in the moment it starts, instead of waiting up to an hour for Discord's global propagation. New servers get commands instantly on join too.
    • ›Bot command sync now wipes global commands and rewrites every server's command set on startup, so removed slash commands disappear from the menu instead of lingering as placeholders.
    • ›Added an extra hard-delete pass for every server command after sync, removing old names and any leftover removed-command placeholders Discord still returns.
  • v1.72.0042026-06-22

    Discord bot command cleanup

    • ›The bulk-key command is now /massgenkey (same options: amount, temporary, duration, label) for naming consistency with /massgen.
    • ›Slot commands dropped the redundant `slot` suffix: `/linkslot` → `/link`, `/setslots` → `/setcount`, `/slotstatus` → `/status`, `/slotcommands` → `/menu`. Same behavior, shorter to type.
    • ›Removed the old direct Discord interactions webhook path so the hosted bot bridge is the only command source and stale commands cannot keep coming from two places.
  • v1.72.0032026-06-22

    Roblox Users panel + slot/key UX polish

    • ›Every script page now has a **Roblox Users** section listing the Roblox accounts that have actually executed your script, with username, Roblox ID, the key they used, and last-exec time.
    • ›Removed the **Discord links** card from the main dashboard and the Discord links section from the script page - the data wasn't useful day-to-day.
    • ›/freezeslot now takes an optional `user` - omit it to freeze (or unfreeze) every slot at once.
    • ›/compensate now asks for a `user` instead of a slot number, and returns a clear ❌ *User is Not Whitelisted!* embed when the user isn't on the whitelist.
    • ›FAULM keys generated via /genkey no longer start counting down before redemption - the timer only begins once the buyer actually redeems the key.
    • ›Public changelog now publishes one batched release every 3 internal changes, and each release is auto-announced to **#FAULMOR-UPDATE** on Discord.
  • v1.72.0022026-06-22

    Whitelist auto-slots + freeze pauses key timers

    • ›Whitelisting a user with a timed key now automatically assigns them a slot (permanent keys skip the slot system).
    • ›Unwhitelisting a user instantly frees their slot.
    • ›/freezeslot now also pauses the whitelist key timer, and /extendslot bumps the matching key expiry so slot time and access time always stay in sync.
    • ›Retired /addslot and /removeslot - slot lifecycle is fully driven by whitelist/unwhitelist now.
    • ›All slot/whitelist durations consistently use the DD:HH:MM format (e.g. 00:00:01 = 1 minute, 00:01:30 = 1h 30m).
  • v1.72.0012026-06-22

    Stockpile keys in /genkey + new /massgen file delivery

    • ›/genkey now accepts a 'Stockpile' type - choose a day count and the timer only starts when the buyer first activates the key.
    • ›New /massgen command generates up to 1000 keys in one shot and DMs them back as a .txt attachment for easy import into your storefront.
    • ›Panel redemption forwards the stockpile flag to the dashboard so the script key inherits the correct activation behavior.
  • v1.72.0002026-06-22

    Stockpile keys - timer starts on first use

    • ›New key type 'stockpile' lets sellers pre-generate keys whose lifetime only begins when the buyer first activates them.
    • ›No more wasted days while a key sits in your sales queue - generate a batch of 30-day keys once, sell them whenever.
  • v1.71.0722026-06-21

    Hosted Discord bot startup alignment

    • ›Bot zip startup targets now point to the same hosted command bridge and print clearer logs when a command reaches the bot host.
  • v1.71.0712026-06-21

    Hosted Discord bot command bridge

    • ›The standalone Discord bot now loads and runs the full Faulmor command set directly from bot hosting, including slot status and panel actions.
  • v1.71.0702026-06-21

    Discord bot auto-registers commands

    • ›The standalone Discord bot now publishes its slash commands on startup, so `/ping`, `/linkapi`, and `/setslots` appear without a separate setup step.
  • v1.71.0692026-06-21

    Discord command response fix

    • ›Discord slash commands now acknowledge immediately from the dashboard endpoint, preventing 'Application did not respond' when a command needs backend work.
  • v1.71.0682026-06-21

    Discord bot Node 22 startup fix

    • ›Updated the standalone Discord bot package so locked hosting panels can run it with plain `node index.js` without a TypeScript loader crash.
  • v1.71.0672026-06-21

    Discord bot panel startup fix

    • ›Added a root bot entrypoint for hosting panels that force `node index.js`, preventing missing-entry startup crashes.
  • v1.71.0662026-06-21

    Discord bot crash diagnostics

    • ›The standalone Discord bot now starts directly from source on common hosts and prints clearer configuration errors instead of only exiting with code 1.
  • v1.71.0652026-06-20

    Discord bot revert

    • ›Reverted the deferred-ack change. Commands reply directly again; the occasional cold-start miss is an accepted limitation of the HTTPS endpoint.
  • v1.71.0642026-06-20

    Admin abuse feed fix

    • ›Admin abuse panel now shows every recent security event instead of silently filtering most of them out.
  • v1.71.0632026-06-20

    Discord bot reliability

    • ›Slash commands now ack Discord instantly and post the result when ready, fixing 'application did not respond' on the first command after a cold start.
  • v1.71.0622026-06-20

    Loader delivery hardening

    • ›Reworked loader delivery so intercepted network traffic no longer exposes the full loader as readable text.
  • v1.71.0612026-06-20

    Admin panel cleanup

    • ›Removed the optional email verification step for the admin panel; access remains restricted to the Discord ID allowlist.
  • v1.71.0602026-06-20

    Anti-dumper hardening

    • ›Added structural protections against server-side script-dumper bots.
    • ›Suspicious request sources are now routed to an inert decoy instead of receiving the real script.
  • v1.71.0592026-06-20

    Protection improvements

    • ›Tightened constant-table protection on protected scripts.
  • v1.71.0582026-06-20

    Loader reliability

    • ›Fixed an integrity check that could cause loaders to exit without any output. Failures now surface a clear console warning instead of being silent.
  • v1.71.0572026-06-19

    Script delivery reliability

    • ›Scripts that previously delivered nothing on execute now run reliably via an automatic fallback path.
  • v1.71.0562026-06-19

    Removed /slots command

    • ›Removed the `/slots` Discord command - use `/slotstatus` instead.
  • v1.71.0552026-06-19

    Discord bot paid loadstring

    • ›Discord `Get Script` button now returns the `script_key="..."` format for paid scripts, matching the dashboard.
  • v1.71.0542026-06-19

    Paid loadstring format

    • ›Paid script snippets now use the simple `script_key="..."` + plain loader URL format, matching FFA style.
  • v1.71.0532026-06-19

    FFA loader hotfix

    • ›Fixed a loader parse error that could surface as a runtime error in the user's LocalScript on FFA scripts.
  • v1.71.0522026-06-19

    Executor identifier overhaul

    • ›Loader now reports the correct executor name for Delta, Volt, Synapse Z, KRNL, Fluxus Z, Arceus X, Potassium, Solara and others.
    • ›Detection reads through getgenv() so executors that hide globals from script fenv are identified correctly.
  • v1.71.0512026-06-19

    Monetized loader lockdown

    • ›Paid script delivery now uses the same keyless loader handoff as FFA mode.
    • ›Raw paid loader source no longer includes the user's reusable script key.
  • v1.71.0502026-06-19

    Raw delivery lockdown

    • ›Closed a direct delivery path so free loaders no longer expose a reusable key in raw source.
    • ›Execution now fails closed if the protected delivery layer cannot be produced.
  • v1.71.0492026-06-19

    Payload delivery hardening

    • ›Scripts are now delivered through the protected runtime by default, reducing what a runtime inspector can capture.
    • ›Automatic fallback keeps unsupported scripts running.
  • v1.71.0482026-06-19

    Admin panel access simplified

    • ›Removed the email 2-step code step on the admin panel - allowlisted admins now go straight in.
  • v1.71.0462026-06-19

    Admin script testing

    • ›Admins can open a dedicated Script Testing area from the admin panel to create API keys and try scripts without touching the public dashboard.
  • v1.71.0452026-06-19

    Loader hardening

    • ›Added additional integrity protections to the loader against tampering.
    • ›No changes to legitimate executor compatibility.
  • v1.71.0442026-06-17

    Maintenance overlay shows for signed-in users

    • ›Maintenance overlay now displays for all non-admin visitors, including signed-in users.
    • ›Only verified admins alternative access the overlay so they can keep operating the panel.
  • v1.71.0432026-06-17

    Maintenance mode frontend

    • ›The site now shows a full-screen maintenance overlay to visitors when maintenance mode is active.
    • ›Increased the maintenance message limit from 280 to 2000 characters so longer announcements fit.
  • v1.71.0422026-06-16

    Execution performance fix

    • ›Reduced live execution overhead so valid scripts start faster on slower executors.
    • ›Adjusted compatibility handling so uploaded scripts execute closer to their original runtime behavior.
  • v1.71.0412026-06-14

    Executor handoff fix

    • ›Improved execution handoff compatibility for executors that isolate script environments differently.
    • ›Expanded request response handling so valid scripts can load across more executor variants.
  • v1.71.0402026-06-14

    Executor compatibility fix

    • ›Improved script delivery compatibility for executors that expose request support differently.
    • ›Extended valid execution response handling so larger protected payloads run more reliably.
  • v1.71.0392026-06-13

    Execution delivery fix

    • ›Improved script delivery compatibility across executors that handle backend requests differently.
    • ›Kept the loader verification flow intact while making valid executions more reliable.
  • v1.71.0382026-06-11

    Tighter protection layer

    • ›Closed two long-standing shape leaks in protected output so common patterns are harder to fingerprint.
    • ›Roundtrip + regression tests extended to cover the new paths.
  • v1.71.0372026-06-11

    Hardened protection layer

    • ›Locked in stronger output protection across all script downloads and live executions.
    • ›Added regression checks so the protection layer can't silently regress.
  • v1.71.0362026-06-11

    Cleaner FFA ↔ Monetize switch

    • ›Switching a script to FFA now auto-disables existing lifetime and temporary keys; switching to Monetize disables the public FFA key.
    • ›Whitelisting a user with an infinite/lifetime key no longer takes up a slot.
  • v1.71.0352026-06-11

    Delete script from dashboard

    • ›Owners can now permanently delete a script from its dashboard page - wipes keys, slots, source, and backups in one click.
    • ›Two confirmations required so you don't nuke a live script by accident.
  • v1.71.0342026-06-11

    FFA fix + Maintenance Mode

    • ›New FFA scripts now show the loader loadstring right away - no more toggling paid/FFA to make it appear.
    • ›Admins can flip Faulmor into Maintenance Mode from the admin panel; users see a clear message and dashboard actions are frozen until it's turned off.
  • v1.71.0332026-06-11

    FFA mode: cleaner dashboard

    • ›FFA mode now shows a single loadstring panel instead of a confusing key entry.
    • ›Anyone can run an FFA script with just the loader line - no script_key, no setup.
  • v1.71.0322026-06-11

    Rename: free → FFA mode

    • ›Renamed free scripts to FFA mode in the dashboard.
    • ›FFA mode runs from just the loader loadstring - no script_key required.
  • v1.71.0312026-06-11

    Security: hardened loader handoff

    • ›Tightened how the loader talks to our backend to better protect session data in transit.
  • v1.71.0302026-06-11

    Tweak: friendlier FAQ

    • ›Rewrote the homepage FAQ to be simpler, shorter, and easier to understand.
  • v1.71.0292026-06-11

    Tweak: simpler Secured Script section

    • ›Rewrote the Secured Script section to be shorter, friendlier, and easier to skim.
  • v1.71.0282026-06-11

    Tweak: clearer pipeline steps

    • ›Rewrote the three pipeline steps on the homepage to be simpler and easier to follow.
  • v1.71.0272026-06-11

    Tweak: clearer homepage intro

    • ›Rewrote the homepage headline and intro to be simpler and easier to understand.
  • v1.71.0262026-06-11

    Tweak: pipeline section headline

    • ›Updated the pipeline heading copy on the homepage.
  • v1.71.0252026-06-11

    Fix: bot-check works in preview too

    • ›Preview builds now use a safe verification path while the live faulmor.site domain keeps the real bot-check challenge.
  • v1.71.0242026-06-11

    Fix: bot-check no longer gets stuck loading

    • ›Updated site security rules so the verification challenge can load properly, with a clearer retry state if it cannot start.
  • v1.71.0232026-06-11

    Fix: bot-check widget now loads on every visit

    • ›Resolved an issue that prevented the verification challenge from appearing on the live site.
  • v1.71.0222026-06-11

    Bot-check at the front door

    • ›Added a quick Cloudflare Turnstile challenge on first visit to keep automated traffic out. Verified visitors are remembered for 24 hours.
  • v1.71.0212026-06-11

    Stronger protection rolled out to all scripts

    • ›All served scripts now go through the latest protection pipeline, not just newly saved ones.
  • v1.71.0202026-06-11

    Official Faulmor logo as site favicon

    • ›Replaced the generic globe favicon with the official Faulmor logo across browsers and link previews.
  • v1.71.0192026-06-10

    Rebranded website references to Secured Script

    • ›All user-facing labels, descriptions, and meta tags now refer to scripts as Secured Script instead of loadstring.
  • v1.71.0182026-06-10

    Fixed protected scripts failing to execute

    • ›Resolved a runtime error that caused every Faulmor-protected loadstring to error on execution. Re-download or regenerate to get the working build.
  • v1.71.0172026-06-09

    Fixed temporary key generation crash

    • ›Generating a temporary key no longer crashes the script page after creation.
  • v1.71.0162026-06-09

    Rewrote the landing page copy

    • ›Cleaned up the hero, pipeline, feature list, FAQ, and final call-to-action with clearer, more professional wording.
    • ›Refreshed the page title and share description to better reflect what Faulmor does.
  • v1.71.0152026-06-09

    Fixed support ticket creation error

    • ›Submitting a new support ticket no longer fails with a database constraint error.
  • v1.71.0142026-06-09

    Fixed support tickets sign-in error

    • ›Creating, viewing, and replying to support tickets no longer fails with an authorization error - the support system now uses the same Discord login as the rest of the site.
  • v1.71.0132026-06-09

    Prettier /slotstatus embed

    • ›The /slotstatus embed now uses a large heading and clean separator lines for a more polished look.
  • v1.71.0122026-06-09

    Polished sign-in copy

    • ›Rewrote the sign-in page description with cleaner, more professional wording that better reflects Faulmor as its own platform.
  • v1.71.0112026-06-09

    Background rain tuned per device

    • ›Background hex particles now spawn from fully off-screen and use a lighter count on Android (10) while keeping the full 40 on desktop.
  • v1.71.0102026-06-09

    Disabled background rain on Android

    • ›Turned off the decorative hex-particle background on Android, where the dynamic address bar was causing the particles to bunch into a horizontal band.
  • v1.71.0092026-06-09

    Smoother background on Android

    • ›Fixed the floating hex particles clumping at the bottom of the screen on Android - they now spread evenly across the page on first load.
  • v1.71.0082026-06-07

    Discord command response fallback

    • ›Discord commands now return instantly when possible and only use the loading state for slower work, preventing commands from getting stuck thinking.
  • v1.71.0072026-06-07

    Simplified admin access

    • ›Removed the email verification step on the admin panel - Discord-ID allowlist is the sole gate for now.
  • v1.71.0062026-06-07

    Admin bot-secret sync button

    • ›Added a one-click button in the admin Bot panel to push the current bot secret into the internal config used by scheduled jobs.
  • v1.71.0052026-06-07

    Hardened admin & internal endpoints

    • ›Re-enabled the email 2FA code on the admin panel - Discord login alone no longer grants access.
    • ›Internal background updaters now require an authenticated caller and reject anonymous traffic.
    • ›Tightened database access rules on sensitive internal tables.
  • v1.71.0042026-06-07

    Discord command follow-up fix

    • ›Discord slash commands now keep their background follow-up alive after the instant defer, so commands no longer stay stuck on the loading state.
  • v1.71.0032026-06-07

    Smooth scroll-in animations

    • ›Landing page sections now gently fade and slide into view as you scroll. Respects reduced-motion preferences.
  • v1.71.0022026-06-07

    Admin support link fix

    • ›Clicking Support Tickets from the admin panel now opens the support queue instead of doing nothing.
  • v1.71.0012026-06-07

    Discord bot reliability

    • ›Slash commands now always ack within Discord's 3-second window - no more “application did not respond” on slow or first-of-the-hour commands.
    • ›Removed an unnecessary pre-verify lookup that was eating into the response budget on cold workers.
  • v1.71.0002026-06-07

    Smooth section scrolling

    • ›Tapping How it works or FAQ from the header (and hamburger menu) now glides to the section instead of jumping.
    • ›Changelog page header layout tidied so the version badge sits on its own line.
  • v1.70.0002026-06-07

    Support tickets

    • ›Signed-in users can open support tickets and chat directly with Faulmor admins from /support.
    • ›FAQ section now links straight to the ticket form for anyone who needs more help.
    • ›Admins get a dedicated /admin/support queue with open/closed filters and reply + close controls.
  • v1.69.0002026-06-07

    Hero refresh - BETA badge + code rain

    • ›Hero pill now reads BETA instead of the version string.
    • ›Floating hex-code strings drift up behind the hero for a subtle background effect.
  • v1.68.0002026-06-07

    Free script loadstring cleanup

    • ›Free scripts now copy a clean loadstring with no script_key line - the public key is baked into the loader.
  • v1.67.0002026-06-07

    Landing polish + mobile nav

    • ›Mobile header now uses a hamburger drawer with full nav access.
    • ›Homepage gained a recent-changelog teaser block.
    • ›Refreshed site meta description and social preview copy.
  • v1.66.0002026-06-07

    Discord invite added across site

    • ›Discord invite (discord.gg/faulmor) now visible in the header, landing CTA, and footer.
  • v1.65.0002026-06-06

    Bulk key generation

    • ›New /genbulkkeys command - generate up to 50 keys in one shot with amount, temporary yes/no, and DD:HH:MM duration.
  • v1.64.0002026-06-06

    Bot invite requests all permissions

    • ›Invite link now pre-checks every Discord permission so the bot works in any channel out of the box.
  • v1.63.0002026-06-06

    Clearer Discord permission errors

    • ›/slotstatus and /deploypanel now explain exactly which channel permissions the bot is missing instead of dumping a raw Discord error.
    • ›/deploypanel no longer reports success when the panel post actually failed.
  • v1.62.0002026-06-06

    Discord embed polish

    • ›Bot replies now use Discord headings, bold highlights, separator lines and richer emojis across help menus and key actions.
  • v1.61.0002026-06-06

    Loader hardening

    • ›Loader responses now ship under an opaque per-request envelope.
  • v1.60.0002026-06-06

    Obfuscator hardening pass

    • ›Additional protection layer applied to every fresh build.
  • v1.59.0022026-06-06

    Public status banner

    • ›Landing page now shows live broadcast announcements from the Admin Panel.
  • v1.59.0012026-06-06

    Discord bot - /unlinkapi

    • ›New /unlinkapi command clears the synced Dashboard API key from the server.
  • v1.59.0002026-06-06

    Admin Panel - operations suite

    • ›Live loader analytics: 7-day request volume, unique IPs, top failure reasons.
    • ›Anti-crack feed surfacing recent tamper / debugger / emulator hits.
    • ›Global kill-switch and broadcast banner controllable from the panel.
    • ›In-panel changelog publisher - new entries appear on this page immediately.
    • ›Obfuscator playground for one-off Lua transforms.
    • ›Full admin audit log of every privileged action.
  • v1.58.0012026-06-06

    Production build fix

    • ›Moved Admin Panel server-only checks behind deployment-safe boundaries so production builds can complete cleanly.
  • v1.58.0002026-06-06

    Admin Panel - email step paused

    • ›Admin Panel access is temporarily Discord-ID-only while we settle email deliverability.
    • ›The two-step email code will return shortly.
  • v1.57.0002026-06-06

    Admin Panel - two-step email verification

    • ›Even with an authorized Discord ID, opening the Administrator Panel now requires a 6-digit code emailed to the operator's confirmation address.
    • ›Codes expire after 10 minutes; verified sessions last 30 minutes before another code is required.
    • ›Built-in rate limiting and one-time-use enforcement on every code.
  • v1.56.0002026-06-06

    Admin Panel - one-click bot sync

    • ›New Administrator Panel for the Faulmor team - visible only to authorized operators.
    • ›Sync Bot button atomically updates the Discord bot's slash commands across every server in one click.
    • ›Live diff view shows which commands are new in code vs. stale on Discord before you sync.
    • ›No more curl or shared secrets needed to ship bot changes.
  • v1.55.0002026-06-06

    Panel Configuration moved to the Dashboard + /deploypanel

    • ›Removed /setuppanel. Panel cosmetics and HWID reset settings now live on each script's Dashboard page under Panel Configuration.
    • ›New /deploypanel command - just pick a channel and (optionally) a buyer role; everything else is pulled from your saved config.
    • ›Edit once on the Dashboard, redeploy in any server with one command. Changes apply to every linked guild for that script.
    • ›Cleaner setup flow: /linkapi → configure on site → /deploypanel.
  • v1.54.0002026-06-06

    Discord panel customization + cleaner embeds

    • ›Panel embeds now use divider lines for a more organized, scannable layout.
    • ›Buyer role color follows your chosen panel color automatically.
  • v1.53.0002026-06-04

    Days 31-40 - pushing toward Luraph-tier obfuscation

    • ›Widened the dual-VM tag-alias pool - outer wire-frequency analysis now sees a flatter distribution.
    • ›More handler variants per hot operation, breaking 1:1 handler fingerprinting between builds.
    • ›Many more dead dispatcher arms in every build to dilute reachable-branch counts.
    • ›Added an opaque-predicate helper and extra junk closures that look real to static analyzers.
    • ›Global / upvalue lookups can now route through a proxy boundary, hiding direct env references.
    • ›New build-key invariant catches another class of keystream tampering.
    • ›Polymorphic IR pass insertion rate increased - even fewer bytes match between two builds of the same script.
    • ›Self-rotating dispatcher marker means a pre-execution snapshot of the chunk doesn't match the live state.
  • v1.43.0002026-06-04

    Days 22-30 - deeper anti-tamper layer

    • ›More environment self-checks during script startup - tampered runtimes are detected faster.
    • ›Internal lookup tables now carry decoy entries and decoy identities that confuse memory dumpers.
    • ›Doubled the number of dead dispatcher arms in the VM, breaking branch-count fingerprinting.
    • ›Expanded the pool of plausible-looking constants embedded in every build.
    • ›Build banner mimics a well-known third-party obfuscator to redirect casual analysis.
  • v1.34.0002026-06-04

    Day 21 - decoy identity for protected scripts

    • ›Internal data structures now identify themselves as harmless Roblox engine objects when inspected by debug tools.
    • ›Print-based dumpers walking memory see misleading labels instead of clear VM state markers.
    • ›Zero overhead on normal execution - only affects what tampering tools observe.
  • v1.33.0042026-06-04

    Smarter response to suspicious sessions

    • ›Flagged sessions now receive a silent decoy response instead of an error, keeping abusive clients busy while the real script stays protected.
    • ›Repeat-offender detection promoted from per-key to per-device and per-network.
    • ›Owners get a Discord alert the moment one of their scripts is touched by something suspicious.
  • v1.33.0032026-06-04

    Improved Security

    • ›Hardened the loader's integrity checks against a wider range of dump tools.
    • ›Added detection for several known emulator/spoofer environments.
    • ›Background watchdog now re-verifies critical functions after handoff.
  • v1.33.0022026-05-28

    Days 10-20 - obfuscator hardening

    • ›Day 10 - instructions stored in a scrambled physical order; virtual-pc → physical-slot table drives dispatch.
    • ›Day 11 - hot ops routed through a separately-encrypted inner dispatch table (dual-VM).
    • ›Day 12 - self-patching bytecode: real opcodes only materialize mid-execution.
    • ›Day 13 - constant payloads fragmented into 1-4 deterministic chunks per build.
    • ›Day 14 - vpc → physical-slot dispatch table encrypted with a per-vpc keystream.
    • ›Day 15 - decoy dispatcher arms + __tostring metatable tripwire.
    • ›Day 16 - constant table permuted per build with key-derived ordering.
    • ›Day 17 - GETGLOBAL / GETTABLE / NOT routed through the inner VM; free-script loader bakes its own script_key.
    • ›Day 18 - outer tag wire is now a 3-id alias set, breaking frequency analysis.
    • ›Day 19 - per-pc operand lane permutation (one of 6 orderings per instruction).
    • ›Day 20 - inner-op alias set: each hot inner op owns 2 distinct ids, picked per pc.